Are they, though? I seriously doubt some sysadmin is going to look at this and say "Maintainers said to patch, but clearly _this guy_ knows better, so I won't."
Besides, he's got a point. The initial PoC that kept popping up on Mastodon (the ones he linked in the post as well) simply didn't work. One of them even posted an updated exploit later that still didn't work, but supposedly meant the vulnerability went from CVSS 10 to CVSS 4.
Which, if true, would at least be kinda funny and would hit institutions that deserve it for having failed to hire trustworthy people that aren't susceptible to that.
So that's a silver lining I guess.
Whoever gets pwned due to this might get naturally out-selected. The system works!!11 Thank you darwin.
If Satan himself proves a theorem, is it nevertheless a true theorem? Claims are either true or they are false. There is no such thing as an evil truth. Where are the breaches?
But don't you understand? The aim wasn't to prevent the breaches that would inevitably happen on day one; it was to prevent the breaches that would happen after that fact. Without mobilising everyone and getting people to patch through an event, we'd be in a far worse position.
The greatest trick that Devil performed was convincing people that he didn't exist, right?
